CVE-2026-52823: Kimai Time Tracking CSRF Vulnerability

CVE-2026-52823 Overview

CVE-2026-52823 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Kimai, an open-source time tracking application. Versions prior to 2.58.0 expose GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart endpoints. These routes reuse an authenticated browser session and perform state-changing operations through HTTP GET requests without any request-forgery defense. An attacker can craft external content that triggers these requests from a logged-in victim's browser. The result is unauthorized stopping of active timesheets or restarting of historical entries.

Critical Impact

Unauthorized state changes can corrupt time records, billing, reports, approvals, and audit trails without user consent.

Affected Products

• Kimai time tracking application, all versions prior to 2.58.0
• Kimai TimesheetController API endpoints for timesheet stop/restart operations
• Deployments exposing the Kimai web interface to authenticated users with browser sessions

Discovery Timeline

• 2026-09-15 - CVE-2026-52823 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52823

Vulnerability Analysis

The vulnerability resides in Kimai's TimesheetController, which exposes two state-changing REST endpoints as HTTP GET requests: /api/timesheets/{id}/stop and /api/timesheets/{id}/restart. Both endpoints rely on the user's existing authenticated browser session cookie for authorization. Neither endpoint validates a CSRF token or enforces a same-origin check before mutating server state. Because the operations use GET, they can be triggered by simple embedded resources such as <img> tags, <iframe> sources, or JavaScript-issued requests from any origin. A logged-in user who visits attacker-controlled content unknowingly issues authenticated requests against the Kimai API.

Root Cause

The root cause is a design violation of HTTP semantics combined with missing anti-CSRF protection. RFC 7231 specifies GET as a safe, idempotent method that must not carry side effects. Kimai's implementation performs write operations on GET without validating a synchronizer token, origin header, or SameSite cookie enforcement. This aligns with the classic CSRF weakness pattern described in [CWE-352].

Attack Vector

An attacker hosts a page containing a resource reference such as <img src="https://victim-kimai.example/api/timesheets/123/stop">. When an authenticated Kimai user loads the page, the browser attaches the session cookie and issues the GET request. The server executes the stop or restart operation as if the user had initiated it. Restart requests create new timesheet entries derived from historical records, allowing attackers to inject fraudulent time data.

# Kimai maintainers hardened the Docker entrypoint as part of the 2.58.0 release
# Source: https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601

function ensureAppSecret() {
  # GHSA-jr9p-4h4j-6c58
  # Make sure the container never runs with the publicly-known default APP_SECRET.
  # If the user provided their own value (via -e APP_SECRET=...) it is kept untouched.
  # Otherwise a unique secret is generated once and persisted below var/data.
  { set +x; } 2>/dev/null

  local SECRET_FILE=/opt/kimai/var/data/.appsecret
  local ENV_LOCAL=/opt/kimai/.env.local

  rm -f "$ENV_LOCAL"

  if [ -n "$APP_SECRET" ] && [ "$APP_SECRET" != "change_this_to_something_unique" ]; then
    set -x
    return
  fi
}

Detection Methods for CVE-2026-52823

Indicators of Compromise

• Web server access logs showing GET requests to /api/timesheets/{id}/stop or /api/timesheets/{id}/restart with Referer headers pointing to external, non-Kimai origins.
• Timesheet audit records showing stop or restart actions occurring at times inconsistent with normal user activity patterns.
• Unexplained new timesheet entries created via the restart endpoint that duplicate historical records.

Detection Strategies

• Deploy a web application firewall (WAF) rule that blocks GET requests to Kimai timesheet state-changing endpoints when the Origin or Referer header does not match the application domain.
• Enable Kimai audit logging and monitor for unexpected state transitions on timesheet objects, especially cross-referenced against user session activity timestamps.
• Review reverse proxy logs for repeated identical timesheet API requests originating from image or iframe loads on unrelated sites.

Monitoring Recommendations

• Alert on any authenticated GET request to the vulnerable endpoints that lacks a same-site referer.
• Continuously monitor billing and approval reports for unexplained modifications tied to timesheet operations.
• Track browser session activity for concurrent requests from multiple origins during a single session.

How to Mitigate CVE-2026-52823

Immediate Actions Required

• Upgrade Kimai to version 2.58.0 or later, which removes the vulnerable GET-based stop and restart routes.
• Invalidate active user sessions after upgrade to force reauthentication and clear any in-flight CSRF exposure.
• Audit timesheet records, billing exports, and approval workflows for unauthorized changes since deployment of a vulnerable version.

Patch Information

The fix is included in Kimai Release v2.58.0. See the GitHub Security Advisory GHSA-r8vr-m544-qh4h, the Kimai Security Announcement, and the merged pull request #5952 for implementation details.

Workarounds

• Configure session cookies with SameSite=Strict or SameSite=Lax to prevent cross-site cookie transmission on the vulnerable endpoints.
• Place a reverse proxy or WAF in front of Kimai that rejects requests to /api/timesheets/{id}/stop and /api/timesheets/{id}/restart when Origin or Referer headers do not match the trusted application domain.
• Restrict access to the Kimai instance via VPN or IP allowlist to reduce exposure of authenticated sessions to arbitrary external content.

# Example nginx rule to reject cross-origin GETs to vulnerable endpoints
location ~ ^/api/timesheets/[0-9]+/(stop|restart)$ {
    if ($http_origin !~* ^https://kimai\.example\.com$) {
        return 403;
    }
    proxy_pass http://kimai_backend;
}